Infrastructure Security

Infrastructure Security Chapter 10

Objectives (1 of 2) • Construct networks using different types of network devices. • Enhance security using security devices. • Understand virtualization concepts. • Enhance security using NAC/NAP methodologies. • Identify the different types of media used to carry network signals. • Describe the different types of storage media used to store information.

Objectives (2 of 2) • Use basic terminology associated with network functions related to information security. • Describe the different types and uses of cloud computing.

Key Terms (1 of 3) • Basic packet filtering • Bridge • Cloud computing • Coaxial cable • Collision domain • Concentrator • Data loss prevention (DLP) • Firewall • Hypervisor • Hub • Infrastructure as a Service (IaaS) • Internet content filters • Load balancer • Modem • Network access control

Key Terms (2 of 3) • Network Access Protection (NAP) • Network Admission Control (NAC) • Network-Attached Storage (NAS) • Network interface card (NIC) • Network operations center (NOC) • Next-generation firewall • Platform as a Service (PaaS) • Private branch exchange (PBX) • Proxy server

Key Terms (3 of 3) • Router • Sandboxing • Servers • Shielded twisted-pair (STP) • Software as a Service (SaaS) • Solid-state drive (SSD) • Switch • Unified threat management (UTM) • Unshielded twisted-pair (UTP) • Virtualization • Web security gateway • Wireless access point • Workstation

Devices • Devices are needed to connect clients and servers and to regulate the traffic between them. • Devices expand the network beyond simple client computers and servers. • Devices come in many forms and with many functions. • Each device has a specific network function and plays a role in maintaining network infrastructure security.

Workstations • The workstation is the machine that sits on the desktop. • It is used every day for sending and reading e-mail, creating spreadsheets, writing reports in a word processing program, and playing games. • A workstation connected to a network is an important part of the network security solution. • Many threats to information security can start at a workstation, but much can be done in a few simple steps to provide protection from many of these threats.

Servers • Servers are the computers in a network that host applications and data for everyone to share. • Servers come in many sizes. • Server operating systems range from Windows Server, to UNIX, to Multiple Virtual Storage (MVS) and other mainframe operating systems • They tend to be more robust than workstation OSs. • They are designed to service multiple users over a network at the same time. • Servers can host a variety of applications.

Mobile Devices • Mobile devices such as laptops, tablets, and mobile phones are the latest devices to join the corporate network. • Mobile devices can create a major security gap, as a user may access separate e-mail accounts, one personal, without antivirus protection, and the other corporate.

Device Security, Common Concerns • As more and more interactive devices are being designed, a new threat source has appeared. • Default accounts and passwords are well known in the hacker community. • First steps you must take to secure such devices is to change the default credentials.

Network-Attached Storage • Because of the speed of today’s Ethernet networks, it is possible to manage data storage across the network. • This has led to a type of storage known as Network- Attached Storage (NAS). • The combination of inexpensive hard drives, fast networks, and simple application-based servers has made NAS devices in the terabyte range affordable for even home users. • As a network device, it is susceptible to attacks.

Removable Storage • Removable devices can move data outside of the corporate-controlled environment. • Removable devices can bring unprotected or corrupted data into the corporate environment. • All removable devices should be scanned by antivirus software upon connection to the corporate environment. • Corporate policies should address the copying of data to removable devices.

Virtualization (1 of 2) • Virtualization technology is used to allow a computer to have more than one OS present and, in many cases, operating at the same time. • Virtualization is an abstraction of the OS layer. • It creates the ability to host multiple OSs on a single piece of hardware. • A major advantage of virtualization is the separation of the software and the hardware. • It creates a barrier that can improve many system functions, including security.

Virtualization (2 of 2) • The underlying hardware is referred to as the host machine, and on it is a host OS. • A hypervisor is needed to manage virtual machines (VMs). • Virtual machines are typically referred to as the guest OSs. • Newer OSs are designed to natively incorporate virtualization hooks. • Common virtualization solutions include: • Microsoft Hyper-V, VMware, Oracle VM VirtualBox, Parallels, and Citrix Xen

Hypervisor (1 of 4) • A hypervisor enables virtualization. • A low-level program that allows multiple operating systems to run concurrently on a single host computer. • The hypervisor acts as the traffic cop that controls I/O and memory management.

Hypervisor (2 of 4) • Major advantages of virtualization: • The separation of the software and the hardware • Creates a barrier that can improve many system functions, including security. • Either the host OS has built-in hypervisor capability or an application is needed to provide the hypervisor function to manage the virtual machines (VMs).

Hypervisor (3 of 4) • Type 1 • Type 1 hypervisors run directly on the system hardware. • Referred to as a native, bare-metal, or embedded hypervisors in typical vendor literature. • Are designed for speed and efficiency, as they do not have to operate through another OS layer. • These platforms come with management toolsets to facilitate VM management in the enterprise.

Hypervisor (4 of 4) • Type 2 • Type 2 hypervisors run on top of a host operating system. • In the beginning, Type 2 hypervisors were the most popular. • Typical Type 2 hypervisors include Oracle’s VirtualBox and VMware’s VMware Workstation Player. • Are designed for limited numbers of VMs, typically in a desktop or small server environment.

Application Cells/Containers • Application cells/containers holds the portions of an OS that it needs separate from the kernel. • Multiple containers can share an OS and have separate memory, CPU, and storage threads. • A container consists of an entire runtime environment • The application platform, including its dependencies, is containerized

VM Sprawl Avoidance • Sprawl is the uncontrolled spreading of disorganization caused by a lack of an organizational structure when many similar elements require management. • VM sprawl is a symptom of a disorganized structure. • VM sprawl avoidance needs to be implemented via policy.

VM Escape Protection • VM escape occurs when software (typically malware) or an attacker escapes from one VM to the underlying OS and then resurfaces in a different VM. • Large-scale VM environments have specific modules designed to detect escape and provide VM escape protection to other modules.

Snapshots • A snapshot is a point-in-time saving of the state of a virtual machine. • Snapshots uses: • Roll a system back to a previous point in time • Undo operations • Provide a quick means of recovery from a complex, system-altering change that has gone awry • Snapshots act as a form of backup and are typically much faster than normal system backup and recovery operations.

Patch Compatibility • Patches are still needed and should be applied, independent of the virtualization status.

Host Availability/Elasticity • In a virtualization environment, protecting the host OS and hypervisor level is critical for system stability. • Best practice is to avoid the installation of any applications on the host-level machine. • Elasticity refers to the ability of a system to expand/contract as system requirements dictate.

Security Control Testing • It is important to test the controls applied to a system to manage security operations to ensure that they are providing the desired results. • It is essential to specifically test all security controls inside the virtual environment to ensure their behavior is still effective.

Sandboxing • Sandboxing refers to the quarantine or isolation of a system from its surroundings. • Virtualization can be used as a form of sandboxing with respect to an entire system.

Networking • Networks are used to connect devices together. • Networks are composed of components that perform networking functions to move data between devices. • Networks begin with network interface cards, then continue in layers of switches and routers. • Specialized networking devices are used for specific purposes, such as security and traffic management.

Network Interface Cards (1 of 2) • To connect a server or workstation to a network, a device known as a network interface card (NIC) is used. • A NIC is the physical connection between a computer and the network. • Each NIC port is serialized with a unique code, 48 bits long, referred to as a Media Access Control address (MAC address). • Unfortunately, these addresses can be changed, or “spoofed,” rather easily.

Network Interface Cards (2 of 2) Figure 10.1 Linksys network interface card (NIC)

Hubs • A hub is networking equipment that connects devices that are using the same protocol at the physical layer of the OSI model. • A hub allows multiple machines in an area to be connected together in a star configuration with the hub at the center. • All connections on a hub share a single collision domain, a small cluster in a network where collisions occur. • Increased network traffic can become limited by collisions; this problem has made hubs obsolete in newer networks. • Hubs also create a security weakness due to sniffing and eavesdropping issues.

Bridges • A bridge operates at the data link layer, filtering traffic based on MAC addresses. • Bridges can reduce collisions by separating pieces of a network into two separate collision domains. • This only cuts the collision problem in half. • A better solution is to use switches for network connections.

Switches (1 of 4) • A switch forms the basis for connections in most Ethernet-based LANs. • Switches have replaced hubs and bridges. • A switch has separate collision domains for each port. • When full duplex is employed, collisions are virtually eliminated from the two nodes, host and client. • A switch is usually a Layer 2 device, but Layer 3 switches incorporate routing functionality.

Switches (2 of 4) • Advantages of switches • They improve network performance by filtering traffic. • They provide the option to disable a port so that it cannot be used without authorization. • They support port security allowing the administrator to control which systems can send data to each of the ports. • Switches use the MAC address of the systems to incorporate traffic filtering and port security features. • Port address security based on MAC addresses functionality is what allows an 802.1X device to act as an “edge device.”

Switches (3 of 4) • Switch security concerns • They are intelligent network devices and are therefore subject to hijacking by hackers. • Switches are commonly administered using the Simple Network Management Protocol (SNMP) and Telnet protocol. • Both protocols have a serious weakness in that they send passwords across the network in cleartext. • Switches are shipped with default passwords. • Switches are subject to electronic attacks, such as ARP poisoning and MAC flooding.

Switches (4 of 4) • Loop protection is a concern with switches. • Switches operate at Layer 2 so there is no countdown mechanism to kill packets that get caught in loops or on paths that will never resolve. • The Layer 2 space acts as a mesh, where potentially the addition of a new device can create loops in the existing device interconnections. • Spanning trees technology is employed to prevent loops. • The Spanning Tree Protocol (STP) allows for multiple, redundant paths, while breaking loops to ensure a proper broadcast pattern.

Routers (1 of 2) • A router is a network traffic management device used to connect different network segments. • Operate at the network layer (Layer 3) of the OSI model • Form the backbone of the Internet • Use algorithms and tables to determine where to send the packet • Use access control lists (ACLs) as a method of deciding whether a packet is allowed to enter the network • Must limit router access and control of internal functions

Routers (2 of 2) Figure 10.2 A small home office router for cable modem/DSL

Firewalls (1 of 5) • A firewall is a network device—hardware, software, or a combination thereof. • Its purpose is to enforce a security policy across its connections by allowing or denying traffic to pass into or out of the network. • The heart of a firewall is the set of security policies that it enforces. • A key to security policies for firewalls is the principle of least access.

Firewalls (2 of 5) Figure 10.3 How a firewall works

Firewalls (3 of 5) Figure 10.4 Linksys RVS4000 SOHO firewall

Firewalls (4 of 5) • The security topology determines what network devices are employed at what points in a network. • The perfect firewall policy is one that the end user never sees and one that never allows even a single unauthorized packet to enter the network. • To develop a complete and comprehensive security policy, it is first necessary to have a complete and comprehensive understanding of your network resources and their uses.

Firewalls (5 of 5) Figure 10.5 Logical depiction of a firewall protecting an organization from the Internet

How Do Firewalls Work? (1 of 2) • Firewalls enforce the established security policies through a variety of mechanisms, including: • Network Address Translation (NAT) • Basic packet filtering • Stateful packet filtering • Access control lists (ACLs) • Application layer proxies • ACLs are a cornerstone of security in firewalls. • Firewalls can also act as network traffic regulators.

How Do Firewalls Work? (2 of 2) Figure 10.6 Firewall with SMTP application layer proxy

Next-Generation Firewalls • Next-generation firewalls are characterized by these features: • Deep packet inspection • Move beyond port/protocol inspection and blocking • Add application-level inspection • Add intrusion prevention • Bring intelligence from outside the firewall • Traffic can be managed based on content, not merely site or URL.

Web Application Firewalls vs. Network Firewalls • A web application firewall is the term given to any software package, appliance, or filter that applies a rule set to HTTP/HTTPS traffic. • They shape web traffic and filter out SQL injection attacks, malware, cross-site scripting (XSS), and so on. • A network firewall is a hardware or software package that controls the flow of packets into and out of a network.

Concentrators • Network devices called concentrators act as traffic management devices, managing flows from multiple points into single streams. • Concentrators typically act as endpoints for a particular protocol, such as SSL/TLS or VPN. • The use of specialized hardware can enable hardware-based encryption and provide a higher level of specific service than a general-purpose server. • This provides both architectural and functional efficiencies.

Wireless Devices (1 of 2) • Wireless devices bring additional security concerns. • Radio waves or infrared carry data, which allows anyone within range access to the data. • The point of entry from a wireless device to a wired network is performed at a device called a wireless access point. • They can support multiple concurrent devices accessing network resources through the network node they create. • Several mechanisms can be used to add wireless functionality to a machine.

Wireless Devices (2 of 2) A typical PCMCIA wireless network card A typical wireless access point

Infrastructure Security